nerdexam
Amazon

SOA-C03 · Question #102

A CloudOps engineer is creating a simple, public-facing website running on Amazon EC2. The CloudOps engineer created the EC2 instance in an existing public subnet and assigned an Elastic IP address…

The correct answer is A. The CloudOps engineer did not create an outbound rule that allows ephemeral port return traffic. Network ACLs are stateless, meaning that return traffic for allowed inbound connections must be explicitly permitted by outbound rules. Although the inbound rule allows HTTP (port 80) from 0.0.0.0/0, if the outbound rule does not allow ephemeral ports (typically 1024–65535)…

Submitted by cyberguy42· Mar 5, 2026Networking

Question

A CloudOps engineer is creating a simple, public-facing website running on Amazon EC2. The CloudOps engineer created the EC2 instance in an existing public subnet and assigned an Elastic IP address to the instance. Next, the CloudOps engineer created and applied a new security group to the instance to allow incoming HTTP traffic from 0.0.0.0/0. Finally, the CloudOps engineer created a new network ACL and applied it to the subnet to allow incoming HTTP traffic from 0.0.0.0/0. However, the website cannot be reached from the internet. What is the cause of this issue?

Options

  • AThe CloudOps engineer did not create an outbound rule that allows ephemeral port return traffic
  • BThe CloudOps engineer did not create an outbound rule in the security group that allows HTTP
  • CThe Elastic IP address assigned to the EC2 instance has changed.
  • DThere is an additional network ACL associated with the subnet that includes a rule that denies

How the community answered

(50 responses)
  • A
    78% (39)
  • B
    12% (6)
  • C
    6% (3)
  • D
    4% (2)

Explanation

Network ACLs are stateless, meaning that return traffic for allowed inbound connections must be explicitly permitted by outbound rules. Although the inbound rule allows HTTP (port 80) from 0.0.0.0/0, if the outbound rule does not allow ephemeral ports (typically 1024–65535), return traffic from the web server to clients will be blocked, preventing users from accessing the website.

Topics

#network ACL#ephemeral ports#stateless firewall#outbound rules

Community Discussion

No community discussion yet for this question.

Full SOA-C03 Practice